Erik Krogh Kristensen
92d59aa11c
refactor most of the isSensitive predicates into a common helper predicate
2021-10-26 13:46:59 +02:00
Erik Krogh Kristensen
834d5ec6ad
add session{key,id} as sensitive info
2021-10-26 13:46:59 +02:00
Erik Krogh Kristensen
283b8231cb
add more cookie models
2021-10-26 13:46:58 +02:00
Erik Krogh Kristensen
2cb3d2c53f
documentation overhaul on client-exposed-cookie (and restricting it to server-side)
2021-10-26 13:46:58 +02:00
Erik Krogh Kristensen
f36accf3e6
only report clear-text cookies for sensitive cookies
2021-10-26 13:46:58 +02:00
Erik Krogh Kristensen
6858acc6a9
port experimental cookie models to non-experimental
2021-10-26 13:46:57 +02:00
Erik Krogh Kristensen
26a24a3895
prepare move to non-experimental
2021-10-26 13:46:57 +02:00
Erik Krogh Kristensen
a3c55c2aec
use set literal instead of big disjunction of literals
2021-10-26 12:55:25 +02:00
Erik Krogh Kristensen
dbd1148bd6
apply range pattern patch to javascript
2021-10-25 19:38:00 +02:00
Geoffrey White
a0e501c3a9
Sync identical files.
2021-10-15 14:34:02 +01:00
Geoffrey White
8f30b8b586
Autoformat.
2021-10-14 16:00:23 +01:00
Geoffrey White
f08d2ee759
Merge branch 'main' into setliterals
2021-10-14 14:39:39 +01:00
Geoffrey White
b9cce57db4
JS: Fix mistake.
2021-10-14 14:22:43 +01:00
Geoffrey White
882adc8e50
JS: Set literals.
2021-10-14 14:22:42 +01:00
Anders Schack-Mulligen
8b6baa250c
Merge pull request #6878 from aschackmull/remove-singleton-setliteral
...
C++/C#/Java/JavaScript/Python: Remove singleton set literals.
2021-10-14 14:53:05 +02:00
Mathias Vorreiter Pedersen
47a85bbb1d
Merge pull request #6869 from MathiasVP/fix-prefix/suffix-equality
...
Java/JS/Python: Replace '.prefix'/'.suffix' with '.matches'
2021-10-14 13:47:03 +01:00
Erik Krogh Kristensen
047aee313c
add pragma[noinline] to predicates where the qldoc mentions join-order
2021-10-14 12:34:25 +02:00
Tom Hvitved
f5420333e2
Sync shared files
2021-10-14 11:49:02 +02:00
Anders Schack-Mulligen
57cb300759
C++/C#/Java/JavaScript/Python: Remove singleton set literals.
2021-10-14 11:34:22 +02:00
Mathias Vorreiter Pedersen
a2371370ff
Merge pull request #6865 from MathiasVP/fix-if-none
...
C++/C#/JS/Python: Replace 'if p() then q() else none()' with a conjunction
2021-10-13 19:47:55 +01:00
Mathias Vorreiter Pedersen
4991301f36
JS: Fix incorrect fix.
2021-10-13 19:45:02 +01:00
Andrew Eisenberg
0d1632a5d2
Move tutorial directly into each qlpack
...
Previously, the tutorial was injected during build time. This is much
simpler.
2021-10-13 08:37:04 -07:00
Mathias Vorreiter Pedersen
f3bb0a676e
JS: Replace '.prefix'/'.suffix' with '.matches'.
2021-10-13 13:23:07 +01:00
Mathias Vorreiter Pedersen
887849857d
JS: Replace 'if p() then q() else none()' with a conjunction.
2021-10-13 12:13:55 +01:00
yoff
f6122c8a6c
Merge pull request #6734 from erik-krogh/regBehind
...
JS/PY: do not filter away regular expressions with lookbehinds
2021-10-10 13:54:26 +02:00
Henry Mercer
4b069d41f6
Merge pull request #6818 from github/henrymercer/js/add-classify-files-to-library-pack
...
JS: Move `ClassifyFiles.qll` to library pack
2021-10-07 11:18:20 +01:00
Henry Mercer
83cbc86f50
JS: Move ClassifyFiles.qll to library pack
...
This allows us to use this library in packs that depend on the
`codeql/javascript-all` library pack.
2021-10-06 16:08:06 +01:00
Andrew Eisenberg
57ef989a89
Fixes compile errors by moving files
...
The two files moved in this commit are referenced from the
javascript/lib qlpack, but they are located in the
javascript/src qlpack. This causes compile errors when running
compile-ish commands for javascript queries. Moving the
files fixes it.
2021-10-05 14:00:02 -07:00
CodeQL CI
40d98ad678
Merge pull request #6789 from asgerf/js/restrict-package-exports
...
Approved by erik-krogh
2021-10-05 06:20:23 +01:00
Asger Feldthaus
cbd577694c
JS: Autoformat
2021-10-04 13:30:15 +02:00
Erik Krogh Kristensen
8d6cac76cc
apply suggestions from asgerf
2021-10-04 12:45:02 +02:00
yoff
1ce9426adf
Merge pull request #6761 from RasmusWL/cryptodome-sha3
...
Python/JS: Recognize SHA-3 hash functions
2021-10-01 13:33:36 +02:00
Asger Feldthaus
600e5bad0d
JS: Exclude methods declared private/protected
2021-10-01 11:46:32 +02:00
Asger Feldthaus
af1b04de9c
JS: Restrict what property names that are considered public exports
2021-10-01 11:42:03 +02:00
Erik Krogh Kristensen
694016dcbe
add missing qldoc
2021-10-01 09:01:57 +02:00
Erik Krogh Kristensen
6a9277b5ce
recognize string sanitizers for ldap-injection
2021-10-01 09:01:29 +02:00
Erik Krogh Kristensen
2062afc868
add calls to parseDN as sinks for ldap-injection
2021-10-01 09:01:28 +02:00
Erik Krogh Kristensen
d4de5e3248
refactoring and renamings in the ldap model
2021-10-01 09:01:14 +02:00
Erik Krogh Kristensen
c55b7bcd85
model ldap filters as taint steps
2021-10-01 09:00:10 +02:00
Erik Krogh Kristensen
2b286a856c
naively move ldap into the SQL injection query
2021-10-01 09:00:10 +02:00
Rasmus Wriedt Larsen
987b573709
Fix hasLocationInfo URL reference
...
Follow up to https://github.com/github/codeql/pull/5830
2021-09-29 13:47:58 +02:00
Erik Krogh Kristensen
8d556ed1e1
Update python/ql/lib/semmle/python/security/BadTagFilterQuery.qll
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2021-09-28 23:04:28 +02:00
Rasmus Wriedt Larsen
ded3088529
Python/JS: Recognize SHA-3 hash functions
...
Official names are SHA3-224, SHA3-256, SHA3-384, SHA3-512 as per
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
2021-09-27 12:08:40 +02:00
Erik Krogh Kristensen
a082ed917c
track flow through string replace calls that just replace single chars
2021-09-22 19:43:48 +02:00
Erik Krogh Kristensen
805d1d170c
do not filter away regular expressions with lookbehinds
2021-09-22 17:14:29 +02:00
Erik Krogh Kristensen
99ed4a1a89
add a bad-tag-filter query for Python and JavaScript
2021-09-21 15:04:03 +02:00
Erik Krogh Kristensen
c40ffab093
make isStartState public in ReDoSUtil
2021-09-21 12:14:21 +02:00
Erik Krogh Kristensen
672e4a3d72
cache TopLevel::isMinified
2021-09-21 12:13:37 +02:00
Erik Krogh Kristensen
60993214d5
cache isInterpretedAsRegExp
2021-09-21 12:13:37 +02:00
Erik Krogh Kristensen
5c73fed83a
fix dbsheme upgrade from TypeScript 4.4 PR
2021-09-15 22:38:27 +02:00
